X Tutup
Skip to content

Commit ba0ea09

Browse files
jshajsha
authored
integration: save hierarchy across runs (letsencrypt#5729)
This allows repeated runs using the same hiearchy, and avoids spurious errors from ocsp-updater saying "This CA doesn't have an issuer cert with ID XXX" Fixes letsencrypt#5721
1 parent 23dd1e2 commit ba0ea09

32 files changed

+98
-94
lines changed

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,3 +37,5 @@ tags
3737
.idea
3838

3939
.vscode/*
40+
.hierarchy/
41+
.softhsm-tokens/

‎docker-compose.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@ services:
99
volumes:
1010
- .:/go/src/github.com/letsencrypt/boulder:cached
1111
- ./.gocache:/root/.cache/go-build:cached
12+
- ./.hierarchy:/hierarchy/:cached
13+
- ./.softhsm-tokens/:/var/lib/softhsm/tokens/:cached
1214
networks:
1315
bluenet:
1416
ipv4_address: 10.77.77.77

‎test/cert-ceremonies/generate.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ func genCert(path string) error {
7676
func main() {
7777
// If one of the output files already exists, assume this ran once
7878
// already for the container and don't re-run.
79-
outputFile := "/tmp/root-signing-pub-rsa.pem"
79+
outputFile := "/hierarchy/root-signing-pub-rsa.pem"
8080
if loc, err := os.Stat(outputFile); err == nil && loc.Mode().IsRegular() {
8181
fmt.Println("skipping certificate generation: already exists")
8282
return
@@ -113,13 +113,13 @@ func main() {
113113
// signing key slots and IDs
114114
rsaTmpIntermediateA, err := rewriteConfig("test/cert-ceremonies/intermediate-ceremony-rsa.yaml", map[string]string{
115115
"SlotID": rsaRootKeySlot,
116-
"CertPath": "/tmp/intermediate-cert-rsa-a.pem",
116+
"CertPath": "/hierarchy/intermediate-cert-rsa-a.pem",
117117
"CommonName": "CA intermediate (RSA) A",
118118
})
119119
cmd.FailOnError(err, "failed to rewrite RSA intermediate cert config with key ID")
120120
ecdsaTmpIntermediateA, err := rewriteConfig("test/cert-ceremonies/intermediate-ceremony-ecdsa.yaml", map[string]string{
121121
"SlotID": ecdsaRootKeySlot,
122-
"CertPath": "/tmp/intermediate-cert-ecdsa-a.pem",
122+
"CertPath": "/hierarchy/intermediate-cert-ecdsa-a.pem",
123123
"CommonName": "CA intermediate (ECDSA) A",
124124
})
125125
cmd.FailOnError(err, "failed to rewrite ECDSA intermediate cert config with key ID")
@@ -134,13 +134,13 @@ func main() {
134134
// signing key slots and IDs
135135
rsaTmpIntermediateB, err := rewriteConfig("test/cert-ceremonies/intermediate-ceremony-rsa.yaml", map[string]string{
136136
"SlotID": rsaRootKeySlot,
137-
"CertPath": "/tmp/intermediate-cert-rsa-b.pem",
137+
"CertPath": "/hierarchy/intermediate-cert-rsa-b.pem",
138138
"CommonName": "CA intermediate (RSA) B",
139139
})
140140
cmd.FailOnError(err, "failed to rewrite RSA intermediate cert config with key ID")
141141
ecdsaTmpIntermediateB, err := rewriteConfig("test/cert-ceremonies/intermediate-ceremony-ecdsa.yaml", map[string]string{
142142
"SlotID": ecdsaRootKeySlot,
143-
"CertPath": "/tmp/intermediate-cert-ecdsa-b.pem",
143+
"CertPath": "/hierarchy/intermediate-cert-ecdsa-b.pem",
144144
"CommonName": "CA intermediate (ECDSA) B",
145145
})
146146
cmd.FailOnError(err, "failed to rewrite ECDSA intermediate cert config with key ID")

‎test/cert-ceremonies/intermediate-ceremony-ecdsa.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@ pkcs11:
55
signing-key-slot: {{ .SlotID}}
66
signing-key-label: root signing key (ecdsa)
77
inputs:
8-
public-key-path: /tmp/intermediate-signing-pub-ecdsa.pem
9-
issuer-certificate-path: /tmp/root-cert-ecdsa.pem
8+
public-key-path: /hierarchy/intermediate-signing-pub-ecdsa.pem
9+
issuer-certificate-path: /hierarchy/root-cert-ecdsa.pem
1010
outputs:
1111
certificate-path: {{ .CertPath }}
1212
certificate-profile:

‎test/cert-ceremonies/intermediate-ceremony-rsa.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@ pkcs11:
55
signing-key-slot: {{ .SlotID}}
66
signing-key-label: root signing key (rsa)
77
inputs:
8-
public-key-path: /tmp/intermediate-signing-pub-rsa.pem
9-
issuer-certificate-path: /tmp/root-cert-rsa.pem
8+
public-key-path: /hierarchy/intermediate-signing-pub-rsa.pem
9+
issuer-certificate-path: /hierarchy/root-cert-rsa.pem
1010
outputs:
1111
certificate-path: {{ .CertPath }}
1212
certificate-profile:

‎test/cert-ceremonies/intermediate-key-ceremony-ecdsa.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,4 @@ key:
88
type: ecdsa
99
ecdsa-curve: P-384
1010
outputs:
11-
public-key-path: /tmp/intermediate-signing-pub-ecdsa.pem
11+
public-key-path: /hierarchy/intermediate-signing-pub-ecdsa.pem

‎test/cert-ceremonies/intermediate-key-ceremony-rsa.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,4 @@ key:
88
type: rsa
99
rsa-mod-length: 2048
1010
outputs:
11-
public-key-path: /tmp/intermediate-signing-pub-rsa.pem
11+
public-key-path: /hierarchy/intermediate-signing-pub-rsa.pem

‎test/cert-ceremonies/intermediate-ocsp-rsa.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,10 @@ pkcs11:
55
signing-key-slot: {{ .SlotID}}
66
signing-key-label: root signing key (rsa)
77
inputs:
8-
certificate-path: /tmp/intermediate-cert-rsa-a.pem
9-
issuer-certificate-path: /tmp/root-cert-rsa.pem
8+
certificate-path: /hierarchy/intermediate-cert-rsa-a.pem
9+
issuer-certificate-path: /hierarchy/root-cert-rsa.pem
1010
outputs:
11-
response-path: /tmp/intermediate-ocsp-rsa.b64
11+
response-path: /hierarchy/intermediate-ocsp-rsa.b64
1212
ocsp-profile:
1313
this-update: 2020-01-01 12:00:00
1414
next-update: 2039-01-01 12:00:00

‎test/cert-ceremonies/root-ceremony-ecdsa.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@ key:
88
type: ecdsa
99
ecdsa-curve: P-384
1010
outputs:
11-
public-key-path: /tmp/root-signing-pub-ecdsa.pem
12-
certificate-path: /tmp/root-cert-ecdsa.pem
11+
public-key-path: /hierarchy/root-signing-pub-ecdsa.pem
12+
certificate-path: /hierarchy/root-cert-ecdsa.pem
1313
certificate-profile:
1414
signature-algorithm: ECDSAWithSHA384
1515
common-name: CA root (ECDSA)

‎test/cert-ceremonies/root-ceremony-rsa.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@ key:
88
type: rsa
99
rsa-mod-length: 4096
1010
outputs:
11-
public-key-path: /tmp/root-signing-pub-rsa.pem
12-
certificate-path: /tmp/root-cert-rsa.pem
11+
public-key-path: /hierarchy/root-signing-pub-rsa.pem
12+
certificate-path: /hierarchy/root-cert-rsa.pem
1313
certificate-profile:
1414
signature-algorithm: SHA256WithRSA
1515
common-name: CA root (RSA)

0 commit comments

Comments
 (0)
X Tutup